⚔️
Marx's CPT Notes
CtrlK
  • Hacks
    • Tools
      • Pivoting Tools
        • Socat
        • Plink.exe
        • SShuttle
        • RPivot
        • Netsh
        • DNScat2
        • Chisel
        • ptunnel-ng
        • SocksOverRDP
      • FFUF
      • SQLMap
      • Responder
    • Proxy
      • Proxy Tools
    • Public Exploits
    • Shells and Payloads
      • MSFvenom
      • Windows Shells
      • *nix Shells
      • WebShells
        • Antak WebShell
    • Metasploit Framework
      • Preparation
      • Payload Generation
      • Databases
      • Plugins
      • Sessions
      • Meterpreter
      • Additional Features
    • TTY
    • Password Attacks
      • Password Bruteforcing
        • Basic HTTP Auth
        • HTTP Forms
        • SSH
        • FTP
      • Password Cracking
      • Password Mutations
      • Remote Password Attacks
      • Windows Local Password Attacks
        • SAM/LSA
        • LSASS
        • Active Directory and NTDS.dit
        • Credential Hunting
      • Linux Local Password Attacks
        • Credential Hunting
        • Passwd, Shadow, and OPassw
      • Windows Lateral Movement
        • Pass the Hash (NTLM)
          • Using Windows
          • Using Linux
        • Pass the Ticket (Kerberos)
          • Using Windows
          • Using Linux
      • Cracking Files
    • Pivoting, Tunneling, and Port Forwarding
      • Port Forwarding
      • Reverse Port Forwarding
      • Scripts
  • Services
    • HTTP (80)
      • SQLi
      • XSS
      • LFI
        • PHP Filters
        • PHP Wrappers
        • RFI
        • with phpinfo()
        • Log Poisoning
      • File Upload Attacks
        • Bypassing Extension
        • Limited File Uploads
        • Other Upload Attacks
      • Command Injection
      • HTTP Verb Tampering
      • IDOR
      • XXE
    • SMB (137,138,139,445)
      • Interacting with SMB
    • SNMP (161,162)
    • NFS (111,2049)
    • DNS (53)
    • SMTP (25,465,587)
    • IMAP/POP3 (110,143,993,995)
      • Interacting with Email
    • MySQL (3306)
      • Interacting with MySQL
    • MSSQL (1433)
      • Interacting with MSSQL
    • Oracle TNS (1521)
    • IPMI (623)
    • FTP (21)
    • SSH (22)
    • RSYNC (873)
    • R-Services (512,513,514)
    • RDP (3389)
    • WinRM (5895,5896)
    • WMI (135)
  • Common Applications
    • Wordpress
    • Joomla
    • Drupal
    • Tomcat
    • Jenkins
    • Splunk
    • PRTG Network Monitor
    • osTicket
    • Gitlab
    • Tomcat CGI
    • CGI Applications
    • Thick Client Applications
    • ColdFusion
    • IIS
    • LDAP
    • Web Mass Assignment Vulnerabilities
    • Applications Connecting to Services
    • Other Notable Applications
  • Enumeration
    • Web Enumeration
      • WHOIS
      • DNS
      • Passive Subdomain Enumeration
      • Passive Infrastructure Identification
      • Active Infrastructure Identification
      • Active Subdomain Enumeration
      • Virtual Hosts
      • Crawling
    • Cloud Enumeration
    • Domain Enumeration
    • Network Enumeration
    • User Enumeration
  • Vulnerability Assessment
    • Common Vulnerability Scoring System
    • Common Vulnerabilities and Exposures
    • Nessus
    • OpenVAS
  • File Transfer Techniques
    • Windows
      • PowerShell Base64 Encode/Decode (Download)
      • PowerShell Web Downloads
      • SMB Downloads
      • FTP Downloads
      • PowerShell Base64 Encode/Decode (Upload)
      • PowerShell Web Uploads
      • SMB Uploads
      • FTP Uploads
    • Linux
      • Base64 Encoding / Decoding
      • Web Downloads
      • SSH Downloads
      • Web Uploads
      • Alternative Web File Transfer Methods
      • SCP Uploads
    • Using Programming Languages
    • Misc File Transfers
    • NGINX Put Method
    • LOLBins
  • Privilege Escalation
    • PrivEsc Techniques
      • Linux
        • Environment-Based
          • Path Abuse
          • Wildcard Abuse
          • Escaping Restricted Shells
        • Pemission-Based
          • Special Permissions
          • Sudo Rights Abuse
          • Privileged Groups
          • Capabilities
        • Service-Based
          • Vulnerable Services
          • Cron Job Abuse
          • LXD/LXC
          • Docker
          • Kubernetes
          • Logrotate
          • Miscellaneous
        • Linux Internals-Based
          • Kernel Exploits
          • Shared Libraries
          • Shared Object Hijacking
          • Python Library Hijacking
        • Recent 0-Days
      • Windows
        • User Privileges
          • SeImpersonate and SeAssignPrimaryToken
          • SeDebugPrivilege
          • SeTakeOwnershipPrivilege
        • Group Privileges
          • Windows Built-in Groups
          • Event Log Readers
          • DNSAdmins
          • Hyper-V Administrators
          • Print Operators
          • Server Operators
        • OS-Based
          • User Access Control
          • Weak Permissiona
          • Kernel Exploits
          • Vulnerable Services
          • DLL Injection
        • Credential Theft
          • Credential Hunting
          • Other Files
          • Further Credential Theft
        • Restricted Environments
          • Citrix Breakout
        • Additional Techniques
          • Interacting with Users
          • Pillaging
          • Miscellaneous Techniques
        • EOL Systems
          • Windows Server
          • Windows Desktop Version
    • PrivEsc References
    • PrivEsc Scripts
  • Active Directory
    • Tools
    • Enumeration
      • External Recon
      • Initial Enumeration of the Domain
    • Exploitation
      • LLMNR/NBT-NS Poisoning
      • Password Spraying
        • Enumerating Password Policy
        • Making a Target User List
        • Exploitation
    • Foothold Enumeration
      • Security Controls
      • Credentialed Enumeration
      • Living Off the Land Techniques
    • Foothold Exploitation
      • Kerberoasting
      • Access Control List (ACL) Abuse
        • ACL Enumeration
        • ACL Abuse Tactics
        • DCSync
    • Lateral Movement
      • Kerberos Double Hop Problem
      • Notable Vulnerabilities
      • Miscellaneous Misconfigurations
      • Domain Trust
        • Enumeration
        • Exploitation
          • Parent Trust
            • Windows
            • Linux
          • Cross-Forest Trust
            • Windows
            • Linux
    • Hardening
      • Auditing Techniques
  • Documentation and Reporting
    • Preparation
      • Types of Reporting
      • Components of a Report
    • Reporting
Powered by GitBook
On this page
  1. Hacks
  2. Password Attacks

Windows Lateral Movement

Pass the Hash (NTLM)Pass the Ticket (Kerberos)
PreviousPasswd, Shadow, and OPasswNextPass the Hash (NTLM)

Last updated 2 years ago